@cybedefend/vibedefend 1.4.7 → 1.6.0

package/dist/hooks/install.js

@@ -26,6 +26,8 @@ export const VIBEDEFEND_DIR = home('.cybedefend');
 export const HOOK_RUNNER_PATH = home('.cybedefend', 'hook-runner.js');
 /** Persisted config the runner reads at hook-invocation time. */
 export const RUNTIME_CONFIG_PATH = home('.cybedefend', 'runtime-config.json');
+/** RE2 engine binary the bundled runner loads from its own directory (BACK-174). */
+const RE2_WASM_FILE = 're2.wasm';
 /** Legacy bash hooks dir from V1; deleted on install if found. */
 const LEGACY_HOOKS_DIR = home('.cybedefend', 'hooks');
 /**
@@ -148,6 +150,21 @@ export function installHookRuntime(opts, deps = {}) {
     const useShim = GLOBAL_MODES.has(installMode) && shimPath !== null;
     ensureDirFor(hookRunnerDest);
     copyFileSync(useShim ? shimPath : runnerSource, hookRunnerDest);
+    // BACK-174 — the bundled RE2 engine reads `re2.wasm` from the runner's own
+    // directory. The shim install runs the runner in place (the wasm sits in
+    // the package's dist/); the full copy needs the wasm copied alongside, or
+    // every hook would silently fall back to native RegExp (no ReDoS bound).
+    if (!useShim) {
+        const wasmSource = join(dirname(runnerSource), RE2_WASM_FILE);
+        if (existsSync(wasmSource)) {
+            try {
+                copyFileSync(wasmSource, join(dir, RE2_WASM_FILE));
+            }
+            catch {
+                // Best-effort: the runner degrades to native RegExp without it.
+            }
+        }
+    }
     const runtimeConfig = {
         region: {
             id: opts.region.id,
@@ -163,13 +180,34 @@ export function installHookRuntime(opts, deps = {}) {
             nonBlockingMode: opts.hooks.nonBlockingMode,
             autoUpdate: useShim ? opts.hooks.autoUpdate : false,
             enableDiffScan: opts.hooks.enableDiffScan,
+            activation: opts.hooks.activation,
         },
         installedVersion: opts.installedVersion,
         ...(useShim ? { runnerSource } : {}),
+        ...keptOrganization(configDest, opts.region),
     };
     writeJson(configDest, runtimeConfig);
     return { runnerPath: hookRunnerDest, configPath: configDest };
 }
+/**
+ * The organization `vibedefend login` (or `vibedefend org`) recorded in the
+ * runtime config, carried over by a re-install of the same region: the file
+ * is rewritten from scratch here, and the proxy and `scan` read the
+ * organization from it. A region switch drops it: organizations belong to
+ * one region's accounts.
+ */
+function keptOrganization(configPath, region) {
+    if (!existsSync(configPath))
+        return {};
+    try {
+        const previous = JSON.parse(readFileSync(configPath, 'utf8'));
+        const sameRegion = previous.region?.id === region.id && previous.region?.apiBase === region.apiBase;
+        return sameRegion && previous.organization ? { organization: previous.organization } : {};
+    }
+    catch {
+        return {};
+    }
+}
 /**
  * Normalise a filesystem path for embedding in a hook `command` string by
  * rewriting `\` to `/`.

package/dist/hooks/install.js.map

@@ -1 +1 @@
-{"version":3,"file":"install.js","sourceRoot":"","sources":["../../src/hooks/install.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACzE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAIzC,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,YAAY,GAEb,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAGtD,kCAAkC;AAClC,MAAM,CAAC,MAAM,cAAc,GAAG,IAAI,CAAC,aAAa,CAAC,CAAC;AAElD,0EAA0E;AAC1E,MAAM,CAAC,MAAM,gBAAgB,GAAG,IAAI,CAAC,aAAa,EAAE,gBAAgB,CAAC,CAAC;AAEtE,iEAAiE;AACjE,MAAM,CAAC,MAAM,mBAAmB,GAAG,IAAI,CACrC,aAAa,EACb,qBAAqB,CACtB,CAAC;AAEF,kEAAkE;AAClE,MAAM,gBAAgB,GAAG,IAAI,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;AAEtD;;;;;;;GAOG;AACH,SAAS,mBAAmB;IAC1B,MAAM,IAAI,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACrD,qEAAqE;IACrE,2EAA2E;IAC3E,wEAAwE;IACxE,qEAAqE;IACrE,MAAM,UAAU,GAAG;QACjB,IAAI,CAAC,IAAI,EAAE,gBAAgB,CAAC;QAC5B,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,gBAAgB,CAAC;QAC1C,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,gBAAgB,CAAC;KACjD,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,IAAI,UAAU,CAAC,CAAC,CAAC;YAAE,OAAO,CAAC,CAAC;IAC9B,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,oBAAoB,CAAC,IAAY;IACxC,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACnC,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,iBAAiB,CAC/B,UAAkB,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAEzD,MAAM,UAAU,GAAG;QACjB,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,SAAS,CAAC,EAAE,kCAAkC;QAClE,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,gCAAgC;QAC9E,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,EAAE,gEAAgE;KAC3F,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,IAAI,UAAU,CAAC,CAAC,CAAC,IAAI,oBAAoB,CAAC,CAAC,CAAC;YAAE,OAAO,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,SAAS,iBAAiB;IACxB,IAAI,UAAU,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACjC,IAAI,CAAC;YACH,MAAM,CAAC,gBAAgB,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAC3D,GAAG,CAAC,IAAI,CAAC,kCAAkC,gBAAgB,EAAE,CAAC,CAAC;QACjE,CAAC;QAAC,MAAM,CAAC;YACP,kCAAkC;QACpC,CAAC;IACH,CAAC;AACH,CAAC;AAaD;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,kBAAkB,CAChC,IAIC,EACD,OAA+B,EAAE;IAEjC,iBAAiB,EAAE,CAAC;IAEpB,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,iBAAiB,CAAC,iBAAiB,EAAE,CAAC,CAAC;IAC/E,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,mBAAmB,CAAC;IAC9D,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,iBAAiB,CAAC;IAExD,MAAM,YAAY,GAAG,YAAY,EAAE,CAAC;IACpC,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CACb,4EAA4E;YAC1E,4CAA4C,CAC/C,CAAC;IACJ,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,IAAI,cAAc,CAAC;IAC3C,MAAM,cAAc,GAAG,IAAI,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;IACnD,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,qBAAqB,CAAC,CAAC;IAEpD,0EAA0E;IAC1E,0EAA0E;IAC1E,wEAAwE;IACxE,kCAAkC;IAClC,MAAM,QAAQ,GAAG,UAAU,EAAE,CAAC;IAC9B,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,QAAQ,KAAK,IAAI,CAAC;IAEnE,YAAY,CAAC,cAAc,CAAC,CAAC;IAC7B,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,QAAS,CAAC,CAAC,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;IAEjE,MAAM,aAAa,GAAkB;QACnC,MAAM,EAAE;YACN,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE;YAClB,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK;YACxB,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO;YAC5B,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM;YAC1B,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO;SAC7B;QACD,KAAK,EAAE;YACL,mBAAmB,EAAE,IAAI,CAAC,KAAK,CAAC,mBAAmB;YACnD,eAAe,EAAE,IAAI,CAAC,KAAK,CAAC,eAAe;YAC3C,eAAe,EAAE,IAAI,CAAC,KAAK,CAAC,eAAe;YAC3C,eAAe,EAAE,IAAI,CAAC,KAAK,CAAC,eAAe;YAC3C,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK;YACnD,cAAc,EAAE,IAAI,CAAC,KAAK,CAAC,cAAc;SAC1C;QACD,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;QACvC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACrC,CAAC;IACF,SAAS,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;IAErC,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC;AAChE,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,WAAW,CAAC,CAAS;IACnC,OAAO,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;AAC/B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,CAAS;IACxC,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AACrC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CACzB,UAMiB,EACjB,aAAqB,gBAAgB;IAErC,0EAA0E;IAC1E,OAAO,QAAQ,gBAAgB,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,IAAI,UAAU,EAAE,CAAC;AAC3E,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,cAAc,CAAC;AAErD;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,mBAAmB,GAAsB;IAC7C,yBAAyB;CAC1B,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,UAAU,4BAA4B,CAC1C,OAAe,EACf,SAAiB,sBAAsB;IAEvC,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACtE,4EAA4E;IAC5E,6EAA6E;IAC7E,2EAA2E;IAC3E,0EAA0E;IAC1E,sBAAsB;IACtB,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IAClC,IAAI,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpD,KAAK,MAAM,MAAM,IAAI,mBAAmB,EAAE,CAAC;QACzC,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;IACzC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,wBAAwB,CACtC,IAAY,EACZ,SAAiB,sBAAsB;IAEvC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAChE,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IACvD,OAAO,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;AAC5C,CAAC"}
+{"version":3,"file":"install.js","sourceRoot":"","sources":["../../src/hooks/install.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACzE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAIzC,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,YAAY,GAEb,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAGtD,kCAAkC;AAClC,MAAM,CAAC,MAAM,cAAc,GAAG,IAAI,CAAC,aAAa,CAAC,CAAC;AAElD,0EAA0E;AAC1E,MAAM,CAAC,MAAM,gBAAgB,GAAG,IAAI,CAAC,aAAa,EAAE,gBAAgB,CAAC,CAAC;AAEtE,iEAAiE;AACjE,MAAM,CAAC,MAAM,mBAAmB,GAAG,IAAI,CACrC,aAAa,EACb,qBAAqB,CACtB,CAAC;AAEF,oFAAoF;AACpF,MAAM,aAAa,GAAG,UAAU,CAAC;AAEjC,kEAAkE;AAClE,MAAM,gBAAgB,GAAG,IAAI,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;AAEtD;;;;;;;GAOG;AACH,SAAS,mBAAmB;IAC1B,MAAM,IAAI,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACrD,qEAAqE;IACrE,2EAA2E;IAC3E,wEAAwE;IACxE,qEAAqE;IACrE,MAAM,UAAU,GAAG;QACjB,IAAI,CAAC,IAAI,EAAE,gBAAgB,CAAC;QAC5B,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,gBAAgB,CAAC;QAC1C,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,gBAAgB,CAAC;KACjD,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,IAAI,UAAU,CAAC,CAAC,CAAC;YAAE,OAAO,CAAC,CAAC;IAC9B,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,oBAAoB,CAAC,IAAY;IACxC,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACnC,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,iBAAiB,CAC/B,UAAkB,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAEzD,MAAM,UAAU,GAAG;QACjB,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,SAAS,CAAC,EAAE,kCAAkC;QAClE,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,gCAAgC;QAC9E,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,EAAE,gEAAgE;KAC3F,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,IAAI,UAAU,CAAC,CAAC,CAAC,IAAI,oBAAoB,CAAC,CAAC,CAAC;YAAE,OAAO,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,SAAS,iBAAiB;IACxB,IAAI,UAAU,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACjC,IAAI,CAAC;YACH,MAAM,CAAC,gBAAgB,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAC3D,GAAG,CAAC,IAAI,CAAC,kCAAkC,gBAAgB,EAAE,CAAC,CAAC;QACjE,CAAC;QAAC,MAAM,CAAC;YACP,kCAAkC;QACpC,CAAC;IACH,CAAC;AACH,CAAC;AAaD;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,kBAAkB,CAChC,IAIC,EACD,OAA+B,EAAE;IAEjC,iBAAiB,EAAE,CAAC;IAEpB,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,iBAAiB,CAAC,iBAAiB,EAAE,CAAC,CAAC;IAC/E,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,mBAAmB,CAAC;IAC9D,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,iBAAiB,CAAC;IAExD,MAAM,YAAY,GAAG,YAAY,EAAE,CAAC;IACpC,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CACb,4EAA4E;YAC1E,4CAA4C,CAC/C,CAAC;IACJ,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,IAAI,cAAc,CAAC;IAC3C,MAAM,cAAc,GAAG,IAAI,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;IACnD,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,qBAAqB,CAAC,CAAC;IAEpD,0EAA0E;IAC1E,0EAA0E;IAC1E,wEAAwE;IACxE,kCAAkC;IAClC,MAAM,QAAQ,GAAG,UAAU,EAAE,CAAC;IAC9B,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,QAAQ,KAAK,IAAI,CAAC;IAEnE,YAAY,CAAC,cAAc,CAAC,CAAC;IAC7B,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,QAAS,CAAC,CAAC,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;IAEjE,2EAA2E;IAC3E,yEAAyE;IACzE,0EAA0E;IAC1E,yEAAyE;IACzE,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,aAAa,CAAC,CAAC;QAC9D,IAAI,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC3B,IAAI,CAAC;gBACH,YAAY,CAAC,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC,CAAC;YACrD,CAAC;YAAC,MAAM,CAAC;gBACP,gEAAgE;YAClE,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,aAAa,GAAkB;QACnC,MAAM,EAAE;YACN,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE;YAClB,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK;YACxB,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO;YAC5B,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM;YAC1B,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO;SAC7B;QACD,KAAK,EAAE;YACL,mBAAmB,EAAE,IAAI,CAAC,KAAK,CAAC,mBAAmB;YACnD,eAAe,EAAE,IAAI,CAAC,KAAK,CAAC,eAAe;YAC3C,eAAe,EAAE,IAAI,CAAC,KAAK,CAAC,eAAe;YAC3C,eAAe,EAAE,IAAI,CAAC,KAAK,CAAC,eAAe;YAC3C,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK;YACnD,cAAc,EAAE,IAAI,CAAC,KAAK,CAAC,cAAc;YACzC,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,UAAU;SAClC;QACD,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;QACvC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpC,GAAG,gBAAgB,CAAC,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC;KAC7C,CAAC;IACF,SAAS,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;IAErC,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC;AAChE,CAAC;AAED;;;;;;GAMG;AACH,SAAS,gBAAgB,CACvB,UAAkB,EAClB,MAAoB;IAEpB,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,EAAE,CAAC;IACvC,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAA2B,CAAC;QACxF,MAAM,UAAU,GACd,QAAQ,CAAC,MAAM,EAAE,EAAE,KAAK,MAAM,CAAC,EAAE,IAAI,QAAQ,CAAC,MAAM,EAAE,OAAO,KAAK,MAAM,CAAC,OAAO,CAAC;QACnF,OAAO,UAAU,IAAI,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,QAAQ,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5F,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,WAAW,CAAC,CAAS;IACnC,OAAO,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;AAC/B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,CAAS;IACxC,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AACrC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CACzB,UAMiB,EACjB,aAAqB,gBAAgB;IAErC,0EAA0E;IAC1E,OAAO,QAAQ,gBAAgB,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,IAAI,UAAU,EAAE,CAAC;AAC3E,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,cAAc,CAAC;AAErD;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,mBAAmB,GAAsB;IAC7C,yBAAyB;CAC1B,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,UAAU,4BAA4B,CAC1C,OAAe,EACf,SAAiB,sBAAsB;IAEvC,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACtE,4EAA4E;IAC5E,6EAA6E;IAC7E,2EAA2E;IAC3E,0EAA0E;IAC1E,sBAAsB;IACtB,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IAClC,IAAI,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpD,KAAK,MAAM,MAAM,IAAI,mBAAmB,EAAE,CAAC;QACzC,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;IACzC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,wBAAwB,CACtC,IAAY,EACZ,SAAiB,sBAAsB;IAEvC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAChE,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IACvD,OAAO,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;AAC5C,CAAC"}

package/dist/hooks/runtime/config.js

@@ -18,6 +18,7 @@
 import { existsSync, readFileSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { join } from 'node:path';
+import { writeFileAtomic } from '../../mcp/config/atomicWrite.js';
 export function runtimeConfigPath() {
     return join(homedir(), '.cybedefend', 'runtime-config.json');
 }
@@ -38,6 +39,43 @@ export function loadRuntimeConfig(path) {
         return null;
     }
 }
+/** The selected organization, or `null` when none is on file (or it is malformed). */
+export function loadRuntimeOrganization(path) {
+    const config = loadRuntimeConfig(path);
+    const organization = config?.organization;
+    if (!organization || typeof organization !== 'object')
+        return null;
+    const { id, name, selectedAt } = organization;
+    if (typeof id !== 'string' || id === '' || typeof name !== 'string')
+        return null;
+    return { id, name, selectedAt: typeof selectedAt === 'string' ? selectedAt : '' };
+}
+/**
+ * Records the selected organization, and nothing else.
+ *
+ * Read-modify-write of the WHOLE file, atomically: the installer owns this
+ * file, and a write that dropped the region or the hook tunables would be an
+ * uninstall nobody asked for. Returns `false` when there is no runtime config
+ * to write into — an organization without a region is meaningless, and
+ * creating the file would make `vibedefend status` report an install that
+ * never happened.
+ */
+export function saveRuntimeOrganization(organization, opts = {}) {
+    const p = opts.path ?? runtimeConfigPath();
+    const current = loadRuntimeConfig(p);
+    if (!current)
+        return false;
+    const next = {
+        ...current,
+        organization: {
+            id: organization.id,
+            name: organization.name,
+            selectedAt: (opts.now ?? new Date()).toISOString(),
+        },
+    };
+    writeFileAtomic(p, `${JSON.stringify(next, null, 2)}\n`, { mode: 0o600 });
+    return true;
+}
 /** Read JSON from stdin (the hook event). Returns `{}` on parse failure. */
 export async function readStdinJson() {
     const chunks = [];

package/dist/hooks/runtime/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../../../src/hooks/runtime/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAIjC,MAAM,UAAU,iBAAiB;IAC/B,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,qBAAqB,CAAC,CAAC;AAC/D,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAa;IAC7C,MAAM,CAAC,GAAG,IAAI,IAAI,iBAAiB,EAAE,CAAC;IACtC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAChC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QACpC,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAkB,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,4EAA4E;AAC5E,MAAM,CAAC,KAAK,UAAU,aAAa;IACjC,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QACxC,MAAM,CAAC,IAAI,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACtE,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACnD,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE;QAAE,OAAO,EAAE,CAAC;IAC3B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;YAClD,CAAC,CAAE,MAAkC;YACrC,CAAC,CAAC,EAAE,CAAC;IACT,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../../src/hooks/runtime/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAGlE,MAAM,UAAU,iBAAiB;IAC/B,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,qBAAqB,CAAC,CAAC;AAC/D,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAa;IAC7C,MAAM,CAAC,GAAG,IAAI,IAAI,iBAAiB,EAAE,CAAC;IACtC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAChC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QACpC,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAkB,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,uBAAuB,CAAC,IAAa;IACnD,MAAM,MAAM,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACvC,MAAM,YAAY,GAAG,MAAM,EAAE,YAAY,CAAC;IAC1C,IAAI,CAAC,YAAY,IAAI,OAAO,YAAY,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACnE,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,YAA4C,CAAC;IAC9E,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,KAAK,EAAE,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACjF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;AACpF,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,uBAAuB,CACrC,YAA0C,EAC1C,OAAsC,EAAE;IAExC,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,IAAI,iBAAiB,EAAE,CAAC;IAC3C,MAAM,OAAO,GAAG,iBAAiB,CAAC,CAAC,CAAC,CAAC;IACrC,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IAC3B,MAAM,IAAI,GAAkB;QAC1B,GAAG,OAAO;QACV,YAAY,EAAE;YACZ,EAAE,EAAE,YAAY,CAAC,EAAE;YACnB,IAAI,EAAE,YAAY,CAAC,IAAI;YACvB,UAAU,EAAE,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE;SACnD;KACF,CAAC;IACF,eAAe,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC1E,OAAO,IAAI,CAAC;AACd,CAAC;AAED,4EAA4E;AAC5E,MAAM,CAAC,KAAK,UAAU,aAAa;IACjC,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QACxC,MAAM,CAAC,IAAI,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACtE,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACnD,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE;QAAE,OAAO,EAAE,CAAC;IAC3B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;YAClD,CAAC,CAAE,MAAkC;YACrC,CAAC,CAAC,EAAE,CAAC;IACT,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC"}

package/dist/hooks/runtime/emit.js

@@ -1,93 +1,166 @@
 /**
  * Which clients need the `hookSpecificOutput.additionalContext` envelope for
  * a given event. Everything not listed here keeps its plain-markdown (or
- * Cursor's own) shape, which is the contract that already works for it.
+ * client-specific) shape, which is the contract that already works for it.
  *
  * SessionStart deliberately does NOT list claude-code: its plain stdout is
  * delivered by contract today and works — leave it alone (BACK-173 §2).
+ * VS Code on PreToolUse: VS Code's Local harness reads this envelope; its
+ * Copilot harness has no PreToolUse context field and ignores it.
  */
 const ENVELOPE_CLIENTS = {
     SessionStart: new Set(['codex']),
-    PreToolUse: new Set(['claude-code', 'codex']),
+    PreToolUse: new Set(['claude-code', 'codex', 'vscode']),
 };
+/**
+ * Client/event pairs where NO output field reaches the model, so the hook
+ * has nothing to deliver and should not do the work (or pay for it).
+ *
+ * Cursor preToolUse: `agent_message` is read only on deny. VS Code is not
+ * listed there because its Local harness does read PreToolUse context.
+ * PreCompact: Cursor reads only `user_message` (shown to the user); VS Code's
+ * Copilot harness processes no output and its Local harness only shows a
+ * `systemMessage`; Codex reads only `continue`/`stopReason`. Claude Code's
+ * PreCompact has no context field either, but its behaviour is left as is.
+ */
+const NO_MODEL_CHANNEL = {
+    PreToolUse: new Set(['cursor']),
+    PreCompact: new Set(['cursor', 'vscode', 'codex']),
+};
+/** Whether a hook's text for `event` can reach the model on `client`. */
+export function hasModelChannel(client, event) {
+    return !NO_MODEL_CHANNEL[event]?.has(client);
+}
+/**
+ * Plain-markdown context for the clients whose contract is plain stdout
+ * (Claude Code SessionStart / UserPromptSubmit, Windsurf).
+ *
+ * Cursor gets nothing: no Cursor event reads plain stdout, and on a
+ * permission hook (preToolUse) invalid JSON blocks the user's action.
+ */
 export function emit(body, client) {
     if (!body)
         return;
-    if (client === 'cursor') {
-        const payload = JSON.stringify({
-            permission: 'allow',
-            agent_message: body,
-        });
-        process.stdout.write(payload);
+    if (client === 'cursor')
         return;
-    }
-    // Default: plain markdown to stdout.
     process.stdout.write(body);
     if (!body.endsWith('\n'))
         process.stdout.write('\n');
 }
 /**
- * Model-context emission for a given hook event.
- *
- * For the clients listed in `ENVELOPE_CLIENTS[hookEventName]`: writes ONE
- * JSON object `{ hookSpecificOutput: { hookEventName, additionalContext } }`
- * so the body lands in the model's context. Callers MUST call this once per
- * hook run — two JSON objects concatenated on stdout are not valid JSON and
- * the agent drops both (see fetch-rules, which accumulates the business and
- * security blocks before emitting).
- *
- * For every other client: delegates to `emit`, which preserves Cursor's
- * permission-allow envelope and the plain-markdown shape that already works
- * for the remaining client/event pairs.
+ * Model-context emission for a given hook event. Callers MUST call this once
+ * per hook run — two JSON objects concatenated on stdout are not valid JSON
+ * and the agent drops both (see fetch-rules, which accumulates the business
+ * and security blocks before emitting).
  */
 export function emitContext(body, client, hookEventName) {
     if (!body)
         return;
+    if (!hasModelChannel(client, hookEventName))
+        return;
+    // Cursor's sessionStart reads only `additional_context` ("added to the
+    // conversation's initial system context").
+    if (client === 'cursor' && hookEventName === 'SessionStart') {
+        writeJson({ additional_context: body });
+        return;
+    }
+    // VS Code SessionStart: top-level `additionalContext` for the Copilot
+    // harness, the nested envelope for the Local harness. Plain markdown is
+    // not JSON, so the Copilot harness dropped the whole bootstrap.
+    if (client === 'vscode' && hookEventName === 'SessionStart') {
+        writeJson({
+            additionalContext: body,
+            hookSpecificOutput: { hookEventName, additionalContext: body },
+        });
+        return;
+    }
     if (ENVELOPE_CLIENTS[hookEventName].has(client)) {
-        const payload = JSON.stringify({
+        writeJson({ hookSpecificOutput: { hookEventName, additionalContext: body } });
+        return;
+    }
+    emit(body, client);
+}
+/**
+ * Clients whose SessionStart accepts JSON carrying a user-visible
+ * `systemMessage` next to `hookSpecificOutput.additionalContext`. Both are
+ * documented by Claude Code and Codex. Codex's SessionStart payload has no
+ * `turn_id`, so it is often sniffed as claude-code, which takes the same path.
+ */
+export const SYSTEM_MESSAGE_CLIENTS = new Set([
+    'claude-code',
+    'codex',
+]);
+/**
+ * SessionStart notice with a line for the USER and context for the MODEL
+ * (used when CybeDefend is off for the session).
+ *
+ * Claude Code / Codex: ONE JSON object — `systemMessage` is shown to the user,
+ * `additionalContext` reaches the model. Other clients have no user-visible
+ * channel here, so they get the model context through {@link emitContext};
+ * that text asks the model to relay the notice.
+ */
+export function emitSessionNotice(notice, client) {
+    if (SYSTEM_MESSAGE_CLIENTS.has(client)) {
+        writeJson({
+            systemMessage: notice.userMessage,
             hookSpecificOutput: {
-                hookEventName,
-                additionalContext: body,
+                hookEventName: 'SessionStart',
+                additionalContext: notice.modelContext,
             },
         });
-        process.stdout.write(payload + '\n');
         return;
     }
-    emit(body, client);
+    emitContext(notice.modelContext, client, 'SessionStart');
 }
 /**
- * Stop-hook emission — the Stop event's output contract differs from the
- * plain-context hooks.
+ * Stop-hook emission: ask the agent for one more turn that runs the
+ * end-of-session review.
  *
- * On Claude Code, a Stop hook's **plain stdout is NOT surfaced to the model**
- * (it only reaches the debug log) — so the gap-analysis (and the pre-commit
- * diff-scan directive) was computed but never reached Claude (BACK-73). To make
- * Claude act on it, a Stop hook must return JSON with `decision: "block"` and a
- * `reason` — `reason` is the field Claude reads on a Stop block.
+ *   - Claude Code: a Stop hook's plain stdout never reaches the model
+ *     (BACK-73), so it returns `decision: "block"` + `reason`. Claude Code
+ *     shows the reason to the user, and the CybeDefend workflow is already
+ *     in its context (MCP `Server.instructions` + the per-prompt doctrine
+ *     hook), so it gets a SINGLE concise `reason` (falling back to `body`).
+ *   - Codex: same `decision`/`reason` shape; Stop rejects plain text.
+ *   - VS Code: top-level `decision`/`reason` (Copilot harness) plus the same
+ *     inside `hookSpecificOutput` (Local harness).
+ *   - Cursor: `followup_message`, submitted as the next user message.
  *
- * Claude Code surfaces a Stop block's `reason` to the USER (in its block
- * render) — and `hookSpecificOutput.additionalContext` is surfaced too, so it
- * does NOT hide anything; putting the verbose directive there just re-dumps it.
- * So we send a SINGLE, concise `reason` and nothing else. It stays actionable
- * because the detailed CybeDefend workflow is already in the model's context
- * (MCP `Server.instructions` + the per-prompt doctrine hook); the Stop reason
- * only needs to TRIGGER it. When no concise `reason` is supplied we fall back
- * to `body`.
- *
- * Cursor keeps its working `{ permission, agent_message }` envelope; every
- * other client keeps plain markdown. Codex / VS Code / Windsurf Stop envelopes
- * are a separate follow-up — their plain-stdout path is not the BACK-73 bug.
+ * The non-Claude clients get the full `body` as the next prompt: they have
+ * no per-prompt doctrine hook, so the concise reason would name tools
+ * without the steps (changed files, upload, polling) needed to use them.
+ * Loop guards (`stop_hook_active`, Cursor's `loop_count`) live in
+ * session-review.
  */
 export function emitStop(body, client, reason) {
     if (!body)
         return;
-    if (client === 'claude-code') {
-        process.stdout.write(JSON.stringify({
-            decision: 'block',
-            reason: reason && reason.trim() ? reason : body,
-        }));
-        return;
+    switch (client) {
+        case 'claude-code':
+            process.stdout.write(JSON.stringify({
+                decision: 'block',
+                reason: reason && reason.trim() ? reason : body,
+            }));
+            return;
+        case 'codex':
+            writeJson({ decision: 'block', reason: body });
+            return;
+        case 'vscode':
+            writeJson({
+                decision: 'block',
+                reason: body,
+                hookSpecificOutput: { hookEventName: 'Stop', decision: 'block', reason: body },
+            });
+            return;
+        case 'cursor':
+            writeJson({ followup_message: body });
+            return;
+        default:
+            emit(body, client);
     }
-    emit(body, client);
+}
+/** One JSON object on one line — the only stdout shape a JSON client parses. */
+function writeJson(payload) {
+    process.stdout.write(JSON.stringify(payload) + '\n');
 }
 //# sourceMappingURL=emit.js.map

package/dist/hooks/runtime/emit.js.map

@@ -1 +1 @@
-{"version":3,"file":"emit.js","sourceRoot":"","sources":["../../../src/hooks/runtime/emit.ts"],"names":[],"mappings":"AA0CA;;;;;;;GAOG;AACH,MAAM,gBAAgB,GAAoD;IACxE,YAAY,EAAE,IAAI,GAAG,CAAW,CAAC,OAAO,CAAC,CAAC;IAC1C,UAAU,EAAE,IAAI,GAAG,CAAW,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;CACxD,CAAC;AAEF,MAAM,UAAU,IAAI,CAAC,IAAY,EAAE,MAAgB;IACjD,IAAI,CAAC,IAAI;QAAE,OAAO;IAElB,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;QACxB,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC;YAC7B,UAAU,EAAE,OAAO;YACnB,aAAa,EAAE,IAAI;SACpB,CAAC,CAAC;QACH,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC9B,OAAO;IACT,CAAC;IAED,qCAAqC;IACrC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC3B,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;AACvD,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,WAAW,CACzB,IAAY,EACZ,MAAgB,EAChB,aAA+B;IAE/B,IAAI,CAAC,IAAI;QAAE,OAAO;IAElB,IAAI,gBAAgB,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QAChD,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC;YAC7B,kBAAkB,EAAE;gBAClB,aAAa;gBACb,iBAAiB,EAAE,IAAI;aACxB;SACF,CAAC,CAAC;QACH,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;QACrC,OAAO;IACT,CAAC;IAED,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AACrB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,QAAQ,CACtB,IAAY,EACZ,MAAgB,EAChB,MAAe;IAEf,IAAI,CAAC,IAAI;QAAE,OAAO;IAElB,IAAI,MAAM,KAAK,aAAa,EAAE,CAAC;QAC7B,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,IAAI,CAAC,SAAS,CAAC;YACb,QAAQ,EAAE,OAAO;YACjB,MAAM,EAAE,MAAM,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI;SAChD,CAAC,CACH,CAAC;QACF,OAAO;IACT,CAAC;IAED,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AACrB,CAAC"}
+{"version":3,"file":"emit.js","sourceRoot":"","sources":["../../../src/hooks/runtime/emit.ts"],"names":[],"mappings":"AA+CA;;;;;;;;;GASG;AACH,MAAM,gBAAgB,GAAoD;IACxE,YAAY,EAAE,IAAI,GAAG,CAAW,CAAC,OAAO,CAAC,CAAC;IAC1C,UAAU,EAAE,IAAI,GAAG,CAAW,CAAC,aAAa,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;CAClE,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,gBAAgB,GAAsD;IAC1E,UAAU,EAAE,IAAI,GAAG,CAAW,CAAC,QAAQ,CAAC,CAAC;IACzC,UAAU,EAAE,IAAI,GAAG,CAAW,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;CAC7D,CAAC;AAEF,yEAAyE;AACzE,MAAM,UAAU,eAAe,CAAC,MAAgB,EAAE,KAAgB;IAChE,OAAO,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;AAC/C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,IAAI,CAAC,IAAY,EAAE,MAAgB;IACjD,IAAI,CAAC,IAAI;QAAE,OAAO;IAClB,IAAI,MAAM,KAAK,QAAQ;QAAE,OAAO;IAEhC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC3B,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;AACvD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CACzB,IAAY,EACZ,MAAgB,EAChB,aAA+B;IAE/B,IAAI,CAAC,IAAI;QAAE,OAAO;IAClB,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,aAAa,CAAC;QAAE,OAAO;IAEpD,uEAAuE;IACvE,2CAA2C;IAC3C,IAAI,MAAM,KAAK,QAAQ,IAAI,aAAa,KAAK,cAAc,EAAE,CAAC;QAC5D,SAAS,CAAC,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAC,CAAC;QACxC,OAAO;IACT,CAAC;IAED,sEAAsE;IACtE,wEAAwE;IACxE,gEAAgE;IAChE,IAAI,MAAM,KAAK,QAAQ,IAAI,aAAa,KAAK,cAAc,EAAE,CAAC;QAC5D,SAAS,CAAC;YACR,iBAAiB,EAAE,IAAI;YACvB,kBAAkB,EAAE,EAAE,aAAa,EAAE,iBAAiB,EAAE,IAAI,EAAE;SAC/D,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAED,IAAI,gBAAgB,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QAChD,SAAS,CAAC,EAAE,kBAAkB,EAAE,EAAE,aAAa,EAAE,iBAAiB,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;QAC9E,OAAO;IACT,CAAC;IAED,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AACrB,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAA0B,IAAI,GAAG,CAAW;IAC7E,aAAa;IACb,OAAO;CACR,CAAC,CAAC;AAEH;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAC/B,MAAqD,EACrD,MAAgB;IAEhB,IAAI,sBAAsB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QACvC,SAAS,CAAC;YACR,aAAa,EAAE,MAAM,CAAC,WAAW;YACjC,kBAAkB,EAAE;gBAClB,aAAa,EAAE,cAAc;gBAC7B,iBAAiB,EAAE,MAAM,CAAC,YAAY;aACvC;SACF,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IACD,WAAW,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,EAAE,cAAc,CAAC,CAAC;AAC3D,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,QAAQ,CACtB,IAAY,EACZ,MAAgB,EAChB,MAAe;IAEf,IAAI,CAAC,IAAI;QAAE,OAAO;IAElB,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,aAAa;YAChB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,IAAI,CAAC,SAAS,CAAC;gBACb,QAAQ,EAAE,OAAO;gBACjB,MAAM,EAAE,MAAM,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI;aAChD,CAAC,CACH,CAAC;YACF,OAAO;QACT,KAAK,OAAO;YACV,SAAS,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/C,OAAO;QACT,KAAK,QAAQ;YACX,SAAS,CAAC;gBACR,QAAQ,EAAE,OAAO;gBACjB,MAAM,EAAE,IAAI;gBACZ,kBAAkB,EAAE,EAAE,aAAa,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE;aAC/E,CAAC,CAAC;YACH,OAAO;QACT,KAAK,QAAQ;YACX,SAAS,CAAC,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC,CAAC;YACtC,OAAO;QACT;YACE,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACvB,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,SAAS,SAAS,CAAC,OAAgC;IACjD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;AACvD,CAAC"}

package/dist/hooks/runtime/fetch-rules.js

@@ -17,8 +17,10 @@ import { sniff } from './sniff.js';
 import { resolveProjectIdWithApi, resolveToken, } from './resolve.js';
 import { fetchBusinessRules, fetchSecurityRules, } from './api.js';
 import { makeUsageNotifier } from './usage-block.js';
-import { emitContext } from './emit.js';
+import { isSessionInactive, sessionFolderOf, } from './session-activation.js';
+import { emitContext, hasModelChannel } from './emit.js';
 import { loadRuntimeConfig, readStdinJson } from './config.js';
+import { projectDirForFile } from './work-dir.js';
 /**
  * Production emitter: the rules body must reach the MODEL, and on Claude
  * Code / Codex a PreToolUse hook's plain stdout never does (BACK-173) — it
@@ -53,12 +55,33 @@ export async function fetchRulesHook(deps = {}) {
         return;
     if (!event.filePath)
         return;
+    // No field carries context to the model on this client's PreToolUse
+    // (Cursor reads `agent_message` only on deny): a fetch would be billed
+    // and logged, then dropped — the BACK-173 defect. See emit.ts.
+    if (!hasModelChannel(event.client, 'PreToolUse'))
+        return;
     const config = loadConfig();
     if (!config)
         return;
+    // SessionStart found no CybeDefend project for this session: stay off.
+    const folder = sessionFolderOf(stdin, event.client);
+    if (isSessionInactive(stdin, { store: deps.sessionStore, cwd: folder }))
+        return;
+    // Edit tools write one file; a shell command may write several — fetch
+    // for all of them and label the callout with the whole list.
+    const files = event.filePaths.length > 0 ? event.filePaths : [event.filePath];
     // Async: falls back to git-origin auto-discovery (cache + bounded 4s
-    // gateway call) when no env var / config.json projectId exists.
-    const { projectId, apiBase: configApiBase } = await resolveProject();
+    // gateway call) when no env var / config.json projectId exists. The
+    // project is the one of the repository the file belongs to when that is
+    // another repository than the agent's (another worktree or clone, BACK-242),
+    // else, or when that repository has no project (a submodule, an unlinked
+    // clone), the agent's.
+    const fileDir = projectDirForFile(files[0], folder);
+    let resolution = await resolveProject(fileDir);
+    if (!resolution.projectId && fileDir !== folder) {
+        resolution = await resolveProject(folder);
+    }
+    const { projectId, apiBase: configApiBase } = resolution;
     if (!projectId)
         return;
     const apiBase = process.env.CYBEDEFEND_API_BASE ?? configApiBase ?? config.region.apiBase;
@@ -68,9 +91,6 @@ export async function fetchRulesHook(deps = {}) {
     if (!token)
         return;
     const intent = buildIntent(event);
-    // Edit tools write one file; a shell command may write several — fetch
-    // for all of them and label the callout with the whole list.
-    const files = event.filePaths.length > 0 ? event.filePaths : [event.filePath];
     const fileLabel = files.join(', ');
     // VibeDefend usage billing: a refused unit (402 VIBEDEFEND_BLOCKED) and a
     // usage warning are told to the agent once per session, in a fixed sentence.
@@ -141,7 +161,7 @@ function buildIntent(event) {
  * Imperative + ready-to-paste template that the agent prepends to its reply.
  *
  * Why a concrete template instead of "consider emitting": Claude Code's TUI
- * collapses MCP tool calls into a one-liner ("utilisé 2 outils"), so the
+ * collapses MCP tool calls into a one-liner ("used 2 tools"), so the
  * user has no visibility into WHICH rules were fetched or HOW the agent
  * applied them. The previous "MANDATORY — emit a status block" language
  * read as guidance and the agent silently applied rules without surfacing

package/dist/hooks/runtime/fetch-rules.js.map

@@ -1 +1 @@
-{"version":3,"file":"fetch-rules.js","sourceRoot":"","sources":["../../../src/hooks/runtime/fetch-rules.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AACnC,OAAO,EACL,uBAAuB,EACvB,YAAY,GAEb,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,kBAAkB,EAClB,kBAAkB,GAEnB,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,iBAAiB,EAAsB,MAAM,kBAAkB,CAAC;AACzE,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACxC,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAG/D;;;;;GAKG;AACH,SAAS,qBAAqB,CAAC,IAAY,EAAE,MAAgB;IAC3D,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,CAAC,CAAC;AAC1C,CAAC;AAED,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC;IAC/B,MAAM;IACN,OAAO;IACP,WAAW;IACX,aAAa;IACb,MAAM;CACP,CAAC,CAAC;AAuBH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAAuB,EAAE;IAC5D,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,aAAa,CAAC;IAClD,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,iBAAiB,CAAC;IACxD,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,IAAI,uBAAuB,CAAC;IACtE,MAAM,UAAU,GAAG,IAAI,CAAC,cAAc,IAAI,YAAY,CAAC;IACvD,MAAM,UAAU,GAAG,IAAI,CAAC,YAAY,IAAI,kBAAkB,CAAC;IAC3D,MAAM,aAAa,GAAG,IAAI,CAAC,oBAAoB,IAAI,kBAAkB,CAAC;IACtE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,qBAAqB,CAAC;IACpD,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,IAAI,iBAAiB,EAAE,CAAC;IAEhE,MAAM,KAAK,GAAG,MAAM,SAAS,EAAE,CAAC;IAChC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;IAE3B,kEAAkE;IAClE,iEAAiE;IACjE,mBAAmB;IACnB,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC;QAAE,OAAO;IAClD,IAAI,CAAC,KAAK,CAAC,QAAQ;QAAE,OAAO;IAE5B,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,IAAI,CAAC,MAAM;QAAE,OAAO;IAEpB,qEAAqE;IACrE,gEAAgE;IAChE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,aAAa,EAAE,GAAG,MAAM,cAAc,EAAE,CAAC;IACrE,IAAI,CAAC,SAAS;QAAE,OAAO;IAEvB,MAAM,OAAO,GACX,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,aAAa,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC;IAE5E,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE;QAC9C,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM;KAC7B,CAAC,CAAC;IACH,IAAI,CAAC,KAAK;QAAE,OAAO;IAEnB,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;IAClC,uEAAuE;IACvE,6DAA6D;IAC7D,MAAM,KAAK,GAAG,KAAK,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC9E,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnC,0EAA0E;IAC1E,6EAA6E;IAC7E,oEAAoE;IACpE,MAAM,SAAS,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;IACrC,MAAM,YAAY,GAAa,EAAE,CAAC;IAClC,MAAM,aAAa,GAAG,CAAC,MAAmB,EAAQ,EAAE;QAClD,MAAM,QAAQ,GACZ,MAAM,CAAC,IAAI,KAAK,SAAS;YACvB,CAAC,CAAC,aAAa,CAAC,WAAW,CAAC,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC;YACpD,CAAC,CAAC,aAAa,CAAC,aAAa,CAAC,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;QAC7D,IAAI,QAAQ;YAAE,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC5C,CAAC,CAAC;IACF,MAAM,SAAS,GAAG;QAChB,OAAO;QACP,SAAS;QACT,KAAK;QACL,KAAK;QACL,MAAM;QACN,IAAI,EAAE,CAAC;QACP,aAAa;KACd,CAAC;IAEF,oEAAoE;IACpE,kEAAkE;IAClE,MAAM,CAAC,cAAc,EAAE,cAAc,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACzD,UAAU,CAAC,SAAS,CAAC;QACrB,aAAa,CAAC,SAAS,CAAC;KACzB,CAAC,CAAC;IAEH,0EAA0E;IAC1E,2EAA2E;IAC3E,yEAAyE;IACzE,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,IAAI,cAAc,EAAE,CAAC;QACnB,MAAM,IAAI,GAAG,WAAW,CACtB,cAAc,CAAC,QAAQ,EACvB,cAAc,CAAC,KAAK,EACpB,SAAS,CACV,CAAC;QACF,IAAI,IAAI;YAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9B,CAAC;IAED,IACE,cAAc;QACd,cAAc,CAAC,KAAK,GAAG,CAAC;QACxB,cAAc,CAAC,QAAQ;QACvB,cAAc,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAClC,CAAC;QACD,MAAM,CAAC,IAAI,CACT,mBAAmB,CACjB,cAAc,CAAC,QAAQ,EACvB,cAAc,CAAC,KAAK,EACpB,SAAS,CACV,CACF,CAAC;IACJ,CAAC;IAED,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,MAAM,CAAC,IAAI,CACT,CAAC,gCAAgC,EAAE,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CACxF,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;AACjE,CAAC;AAED,mFAAmF;AACnF,SAAS,WAAW,CAAC,KAA8B;IACjD,IAAI,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ,IAAI,KAAK,CAAC,UAAU;QAAE,OAAO,KAAK,CAAC,UAAU,CAAC;IACtF,IAAI,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,IAAI,KAAK,CAAC,SAAS;QAAE,OAAO,KAAK,CAAC,SAAS,CAAC;IACnF,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,kEAAkE;AAClE,SAAS,WAAW,CAAC,KAAsB;IACzC,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,uBAAuB,IAAI,KAAK,EAAE,EAAE,CAAC,CAAC;IACzE,MAAM,OAAO,GAAG,KAAK,CAAC,UAAU;SAC7B,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC;SAC9C,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC;SACpB,IAAI,EAAE,CAAC;IACV,OAAO,cAAc,KAAK,CAAC,QAAQ,UAAU,KAAK,CAAC,QAAQ,YAAY,KAAK,CAAC,MAAM,0BAA0B,OAAO,EAAE,CAAC;AACzH,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,SAAS,sBAAsB,CAC7B,IAA6B,EAC7B,KAAa,EACb,QAAgB;IAEhB,MAAM,OAAO,GAAG,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,gBAAgB,CAAC;IACjE,OAAO;QACL,KAAK;QACL,EAAE;QACF,iRAAiR;QACjR,EAAE;QACF,sBAAsB,IAAI,cAAc,KAAK,QAAQ,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,UAAU,QAAQ,IAAI;QACjG,wFAAwF;QACxF,oFAAoF;QACpF,EAAE;QACF,uCAAuC,OAAO,2KAA2K;QACzN,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,oDAAoD;AACpD,SAAS,WAAW,CAClB,QAAgB,EAChB,KAAa,EACb,QAAgB;IAEhB,IAAI,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpC,OAAO;YACL,iCAAiC,KAAK,kBAAkB,QAAQ,GAAG;YACnE,QAAQ;YACR,EAAE;YACF,sBAAsB,CAAC,UAAU,EAAE,KAAK,EAAE,QAAQ,CAAC;SACpD,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACf,CAAC;IACD,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;QAChB,sEAAsE;QACtE,iEAAiE;QACjE,+DAA+D;QAC/D,sBAAsB;QACtB,OAAO;YACL,iDAAiD,QAAQ,GAAG;YAC5D,EAAE;YACF,8CAA8C;YAC9C,EAAE;YACF,KAAK;YACL,EAAE;YACF,sJAAsJ;YACtJ,EAAE;YACF,2DAA2D,QAAQ,iBAAiB;YACpF,EAAE;SACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACf,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,6EAA6E;AAC7E,SAAS,mBAAmB,CAC1B,QAAgB,EAChB,KAAa,EACb,QAAgB;IAEhB,OAAO;QACL,iCAAiC,KAAK,kBAAkB,QAAQ,GAAG;QACnE,QAAQ;QACR,EAAE;QACF,sBAAsB,CAAC,UAAU,EAAE,KAAK,EAAE,QAAQ,CAAC;KACpD,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC"}
+{"version":3,"file":"fetch-rules.js","sourceRoot":"","sources":["../../../src/hooks/runtime/fetch-rules.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AACnC,OAAO,EACL,uBAAuB,EACvB,YAAY,GAEb,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,kBAAkB,EAClB,kBAAkB,GAEnB,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,iBAAiB,EAAsB,MAAM,kBAAkB,CAAC;AACzE,OAAO,EACL,iBAAiB,EACjB,eAAe,GAEhB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AACzD,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAElD;;;;;GAKG;AACH,SAAS,qBAAqB,CAAC,IAAY,EAAE,MAAgB;IAC3D,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,CAAC,CAAC;AAC1C,CAAC;AAED,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC;IAC/B,MAAM;IACN,OAAO;IACP,WAAW;IACX,aAAa;IACb,MAAM;CACP,CAAC,CAAC;AAyBH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAAuB,EAAE;IAC5D,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,aAAa,CAAC;IAClD,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,iBAAiB,CAAC;IACxD,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,IAAI,uBAAuB,CAAC;IACtE,MAAM,UAAU,GAAG,IAAI,CAAC,cAAc,IAAI,YAAY,CAAC;IACvD,MAAM,UAAU,GAAG,IAAI,CAAC,YAAY,IAAI,kBAAkB,CAAC;IAC3D,MAAM,aAAa,GAAG,IAAI,CAAC,oBAAoB,IAAI,kBAAkB,CAAC;IACtE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,qBAAqB,CAAC;IACpD,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,IAAI,iBAAiB,EAAE,CAAC;IAEhE,MAAM,KAAK,GAAG,MAAM,SAAS,EAAE,CAAC;IAChC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;IAE3B,kEAAkE;IAClE,iEAAiE;IACjE,mBAAmB;IACnB,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC;QAAE,OAAO;IAClD,IAAI,CAAC,KAAK,CAAC,QAAQ;QAAE,OAAO;IAC5B,oEAAoE;IACpE,uEAAuE;IACvE,+DAA+D;IAC/D,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,MAAM,EAAE,YAAY,CAAC;QAAE,OAAO;IAEzD,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,IAAI,CAAC,MAAM;QAAE,OAAO;IAEpB,uEAAuE;IACvE,MAAM,MAAM,GAAG,eAAe,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACpD,IAAI,iBAAiB,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,YAAY,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;QAAE,OAAO;IAEhF,uEAAuE;IACvE,6DAA6D;IAC7D,MAAM,KAAK,GAAG,KAAK,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAE9E,qEAAqE;IACrE,oEAAoE;IACpE,wEAAwE;IACxE,6EAA6E;IAC7E,yEAAyE;IACzE,uBAAuB;IACvB,MAAM,OAAO,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IACpD,IAAI,UAAU,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,CAAC;IAC/C,IAAI,CAAC,UAAU,CAAC,SAAS,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;QAChD,UAAU,GAAG,MAAM,cAAc,CAAC,MAAM,CAAC,CAAC;IAC5C,CAAC;IACD,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,aAAa,EAAE,GAAG,UAAU,CAAC;IACzD,IAAI,CAAC,SAAS;QAAE,OAAO;IAEvB,MAAM,OAAO,GACX,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,aAAa,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC;IAE5E,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE;QAC9C,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM;KAC7B,CAAC,CAAC;IACH,IAAI,CAAC,KAAK;QAAE,OAAO;IAEnB,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;IAClC,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnC,0EAA0E;IAC1E,6EAA6E;IAC7E,oEAAoE;IACpE,MAAM,SAAS,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;IACrC,MAAM,YAAY,GAAa,EAAE,CAAC;IAClC,MAAM,aAAa,GAAG,CAAC,MAAmB,EAAQ,EAAE;QAClD,MAAM,QAAQ,GACZ,MAAM,CAAC,IAAI,KAAK,SAAS;YACvB,CAAC,CAAC,aAAa,CAAC,WAAW,CAAC,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC;YACpD,CAAC,CAAC,aAAa,CAAC,aAAa,CAAC,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;QAC7D,IAAI,QAAQ;YAAE,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC5C,CAAC,CAAC;IACF,MAAM,SAAS,GAAG;QAChB,OAAO;QACP,SAAS;QACT,KAAK;QACL,KAAK;QACL,MAAM;QACN,IAAI,EAAE,CAAC;QACP,aAAa;KACd,CAAC;IAEF,oEAAoE;IACpE,kEAAkE;IAClE,MAAM,CAAC,cAAc,EAAE,cAAc,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACzD,UAAU,CAAC,SAAS,CAAC;QACrB,aAAa,CAAC,SAAS,CAAC;KACzB,CAAC,CAAC;IAEH,0EAA0E;IAC1E,2EAA2E;IAC3E,yEAAyE;IACzE,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,IAAI,cAAc,EAAE,CAAC;QACnB,MAAM,IAAI,GAAG,WAAW,CACtB,cAAc,CAAC,QAAQ,EACvB,cAAc,CAAC,KAAK,EACpB,SAAS,CACV,CAAC;QACF,IAAI,IAAI;YAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9B,CAAC;IAED,IACE,cAAc;QACd,cAAc,CAAC,KAAK,GAAG,CAAC;QACxB,cAAc,CAAC,QAAQ;QACvB,cAAc,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAClC,CAAC;QACD,MAAM,CAAC,IAAI,CACT,mBAAmB,CACjB,cAAc,CAAC,QAAQ,EACvB,cAAc,CAAC,KAAK,EACpB,SAAS,CACV,CACF,CAAC;IACJ,CAAC;IAED,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,MAAM,CAAC,IAAI,CACT,CAAC,gCAAgC,EAAE,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CACxF,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;AACjE,CAAC;AAED,mFAAmF;AACnF,SAAS,WAAW,CAAC,KAA8B;IACjD,IAAI,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ,IAAI,KAAK,CAAC,UAAU;QAAE,OAAO,KAAK,CAAC,UAAU,CAAC;IACtF,IAAI,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,IAAI,KAAK,CAAC,SAAS;QAAE,OAAO,KAAK,CAAC,SAAS,CAAC;IACnF,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,kEAAkE;AAClE,SAAS,WAAW,CAAC,KAAsB;IACzC,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,uBAAuB,IAAI,KAAK,EAAE,EAAE,CAAC,CAAC;IACzE,MAAM,OAAO,GAAG,KAAK,CAAC,UAAU;SAC7B,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC;SAC9C,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC;SACpB,IAAI,EAAE,CAAC;IACV,OAAO,cAAc,KAAK,CAAC,QAAQ,UAAU,KAAK,CAAC,QAAQ,YAAY,KAAK,CAAC,MAAM,0BAA0B,OAAO,EAAE,CAAC;AACzH,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,SAAS,sBAAsB,CAC7B,IAA6B,EAC7B,KAAa,EACb,QAAgB;IAEhB,MAAM,OAAO,GAAG,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,gBAAgB,CAAC;IACjE,OAAO;QACL,KAAK;QACL,EAAE;QACF,iRAAiR;QACjR,EAAE;QACF,sBAAsB,IAAI,cAAc,KAAK,QAAQ,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,UAAU,QAAQ,IAAI;QACjG,wFAAwF;QACxF,oFAAoF;QACpF,EAAE;QACF,uCAAuC,OAAO,2KAA2K;QACzN,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,oDAAoD;AACpD,SAAS,WAAW,CAClB,QAAgB,EAChB,KAAa,EACb,QAAgB;IAEhB,IAAI,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpC,OAAO;YACL,iCAAiC,KAAK,kBAAkB,QAAQ,GAAG;YACnE,QAAQ;YACR,EAAE;YACF,sBAAsB,CAAC,UAAU,EAAE,KAAK,EAAE,QAAQ,CAAC;SACpD,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACf,CAAC;IACD,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;QAChB,sEAAsE;QACtE,iEAAiE;QACjE,+DAA+D;QAC/D,sBAAsB;QACtB,OAAO;YACL,iDAAiD,QAAQ,GAAG;YAC5D,EAAE;YACF,8CAA8C;YAC9C,EAAE;YACF,KAAK;YACL,EAAE;YACF,sJAAsJ;YACtJ,EAAE;YACF,2DAA2D,QAAQ,iBAAiB;YACpF,EAAE;SACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACf,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,6EAA6E;AAC7E,SAAS,mBAAmB,CAC1B,QAAgB,EAChB,KAAa,EACb,QAAgB;IAEhB,OAAO;QACL,iCAAiC,KAAK,kBAAkB,QAAQ,GAAG;QACnE,QAAQ;QACR,EAAE;QACF,sBAAsB,CAAC,UAAU,EAAE,KAAK,EAAE,QAAQ,CAAC;KACpD,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC"}

package/dist/hooks/runtime/gateway-http-error.js

@@ -0,0 +1,34 @@
+/**
+ * A gateway call that came back with a non-2xx status.
+ *
+ * Callers need the status to tell three cases apart, and a plain `Error`
+ * hides it (BACK-240 L2):
+ *   - a definitive refusal (400 / 403 / 404 / 422) must not be replayed on
+ *     every tool call: it would get the same answer;
+ *   - a 401 means the credential is rejected: retrying it with the same
+ *     token gets the same answer, a new token may not;
+ *   - anything else (5xx, 429) is transient and is retried after a short
+ *     wait (the response's `Retry-After` when it asks for longer).
+ * A network error or a timeout is not a `GatewayHttpError` (no status).
+ */
+export class GatewayHttpError extends Error {
+    status;
+    /** The response's `Retry-After`, in milliseconds, when it carried one. */
+    retryAfterMs;
+    constructor(status, message, opts = {}) {
+        super(message);
+        this.name = 'GatewayHttpError';
+        this.status = status;
+        if (opts.retryAfterMs !== undefined)
+            this.retryAfterMs = opts.retryAfterMs;
+    }
+}
+/** The HTTP status an error carries, or null (network error, timeout). */
+export function httpStatusOf(e) {
+    return e instanceof GatewayHttpError ? e.status : null;
+}
+/** The `Retry-After` an error carries, in milliseconds, if any. */
+export function retryAfterOf(e) {
+    return e instanceof GatewayHttpError ? e.retryAfterMs : undefined;
+}
+//# sourceMappingURL=gateway-http-error.js.map

package/dist/hooks/runtime/gateway-http-error.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gateway-http-error.js","sourceRoot":"","sources":["../../../src/hooks/runtime/gateway-http-error.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IAChC,MAAM,CAAS;IACxB,0EAA0E;IACjE,YAAY,CAAU;IAE/B,YAAY,MAAc,EAAE,OAAe,EAAE,OAAkC,EAAE;QAC/E,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;QAC/B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS;YAAE,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC;IAC7E,CAAC;CACF;AAED,0EAA0E;AAC1E,MAAM,UAAU,YAAY,CAAC,CAAU;IACrC,OAAO,CAAC,YAAY,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;AACzD,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,YAAY,CAAC,CAAU;IACrC,OAAO,CAAC,YAAY,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC;AACpE,CAAC"}